Database
WordPress vulnerabilities listed in CISA KEV (page 1260)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.4Authenticated Stored Cross-Site Scripting
Request a Quote – Quote Forms for Any WordPress Site
<2.3.4Update to 2.3.4
- High8.8Stored Cross-Site Scripting
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
<3.6.67Update to 3.6.67
- Medium4.8W3 Total Cache <= 2.1.2 Authenticated (Admin+) Stored Cross-Site Scripting
W3 Total Cache
<2.1.3Update to 2.1.3
- Medium6.1Reflected Cross-Site Scripting
Backup by 10Web – Backup and Restore Plugin
≤1.0.20No patch available
- Medium6.1Open Redirect
wpForo Forum
≤1.9.6Update to 1.9.7
- Medium6.4Authenticated (author+) Stored Cross-Site Scripting via SVG
WP SVG Images
≤3.3Update to 3.4
- Medium6.1Reflected Cross-Site Scripting
Jannah - Newspaper Magazine News BuddyPress AMP
<5.4.5Update to 5.4.5
- Medium6.1Reflected Cross-Site Scripting
WP Foodbakery
≤2.1Update to 2.2
- High8.8Cross-Site Request Forgery to Arbitrary File Upload
Stock Manager for WooCommerce
≤2.5.7Update to 2.6.0
- Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting
VikRentCar Car Rental Management System
≤1.1.6Update to 1.1.7
- High7.5Authentication Bypass for PDF Reports
nex-forms
≤7.8.7Update to 7.8.8
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Easy Cookies Policy
≤1.6.2No patch available
- Medium6.1Reflected Cross-Site Scripting
Welcart e-Commerce
≤2.2.3Update to 2.2.4
- Medium6.1Reflected Cross-Site Scripting
Real Estate 7 WordPress
<3.1.1Update to 3.1.1
- Medium6.1Reflected Cross-Site Scripting
Advanced AJAX Product Filters
≤1.5.4.6Update to 1.5.4.7
- Critical9.8Local File Inclusion
Motor – Cars, Parts, Service, Equipments and Accessories WooCommerce Store
<3.1.0Update to 3.1.0
- Critical9.8Object Injection
JoomSport – for Sports: Team & League, Football, Hockey & more
<5.1.8Update to 5.1.8
- Medium4.3Cross-Site Request Forgery Bypass
Custom css-js-php
≤2.0.7No patch available
- Medium4.3Cross-Site Request Forgery Bypass
WP Prayer
≤1.6.5Update to 1.6.6
- Medium4.3Cross-Site Request Forgery Bypass
Qtranslate Slug
≤1.1.18No patch available
- Medium4.3Multiple Roles <= 1.3.1- Cross-Site Request Forgery Bypass
Multiple Roles
≤1.3.1Update to 1.3.2
- High8.8Authenticated Remote Command Execution
Form Manager
<1.7.3Update to 1.7.3
- Medium5.4Authenticated Stored Cross-Site Scripting
Smart Slider 3
<3.5.0.9Update to 3.5.0.9
- Medium5.4Authenticated Stored Cross-Site Scripting
WP Go Maps – Google Map, OpenStreetMap, Leaflet & Store Locator
<8.1.12Update to 8.1.12
- High8.8Arbitrary File Upload to Remote Code Exectution
Recently
≤3.0.4Update to 3.0.5
- Medium5.3Add Like/Dislike Bypass
Comments Like Dislike
<1.1.4Update to 1.1.4
- Medium6.1Newspaper Magazine News BuddyPress AMP < 5.4.4 - Reflected Cross-Site Scripting
Jannah - Newspaper Magazine News BuddyPress AMP
<5.4.4Update to 5.4.4
- Medium6.1Reflected Cross-Site Scripting
WP Hardening (discontinued)
<1.2.2Update to 1.2.2
- Medium6.1Reflected Cross-Site Scripting
WP Hardening (discontinued)
≤1.2.1Update to 1.2.2
- Critical9.8wpDiscuz 7.0 - 7.0.4 - Unauthenticated Arbitrary File Upload leading to Remote Code Execution
Comments – wpDiscuz
7.0 – 7.0.4Update to 7.0.5